145121 matches found
CVE-2025-50365_CSRF_DELETE_CATEGORY-phpgurukul-CVE
Project Name & Repo URL: Maid Hiring Management System using PHP and MySQL Vulnerability Type: Client Side Request Forgery Affected Versions: v1.0 💣Vulnerability Description: A Cross-Site Request Forgery CSRF vulnerability exists in the admin panel of PHPGurukul Hiring Management System, allowing...
NPM: Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL
NPM: Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL vulnerability discovered by ? in WordPress Npm trigger.dev versions 4.5.2...
CVE-2026-39718 WordPress Wallstreet theme <= 2.8.6 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in Webriti Wallstreet wallstreet allows Cross Site Request Forgery.This issue affects Wallstreet: from n/a through 2.8.6...
EUVD-2026-91774
Cross-Site Request Forgery CSRF vulnerability in Webriti Wallstreet wallstreet allows Cross Site Request Forgery.This issue affects Wallstreet: from n/a through 2.8.6...
CVE-2026-39718
The Webriti Wallstreet WordPress theme is vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability. This issue affects versions from the initial release through 2.8.6 . The vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user. No specific expl...
EUVD-2020-31274
Weaver e-Bridge contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to access arbitrary files on the host system by supplying a file: URL to the downloadUrl parameter of the saveYZJFile endpoint. Attackers can exploit this flaw to read sensitive files such a...
CVE-2020-37278 Weaver e-Bridge Unauthenticated Arbitrary File Read via saveYZJFile
Weaver e-Bridge contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to access arbitrary files on the host system by supplying a file: URL to the downloadUrl parameter of the saveYZJFile endpoint. Attackers can exploit this flaw to read sensitive files such a...
Security Bulletin: Vulnerability in i18next-http-middleware bundled with IBM Fusion and IBM Fusion HCI.
Summary IBM Fusion and IBM Fusion HCI include the i18next-http-middleware library, which is affected by multiple vulnerabilities, including prototype pollution, CRLF injection, and server-side request forgery vulnerabilities. CVE-2026-48714, CVE-2026-41683, CVE-2026-41690, CVE-2026-42353...
Security Bulletin: Vulnerability in axios bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging.
Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging include the axios library, which is affected by multiple vulnerabilities, including server-side request forgery, prototype pollution, and denial of service vulnerabilities. CVE-2026-44486, CVE-2026-44487, CVE-2026-44488,...
Security Bulletin: Vulnerability in aiohttp bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Content-Aware Storage.
Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Content-Aware Storage include the aiohttp library, which is affected by multiple vulnerabilities, including HTTP request smuggling and out-of-bounds read vulnerabilities. CVE-2026-69243, CVE-2026-69244. Vulnerability Details CVEID:CVE-2026-69243...
CVE-2026-94485
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...
CVE-2026-66753-HTTP-Header-Injection-via-Unvalidated-CR-and-LF-in-Header-Values-tiny_http-
Security Advisory: HTTP Header Injection via Unvalidated CR and LF in Header Values tinyhttp Assigned CVE ID: CVE-2026-66753 Summary tinyhttp does not reject carriage return or line feed inside HTTP header values, in either direction. On the request side, readnextline ends a header line only on...
POC-CVE-2026-54121-Certighost
CertiGhost CVE-2026-54121 - AD CS Chase Fallback Exploit Toolkit Overview CertiGhost is a critical vulnerability CVSS 8.8 in Active Directory Certificate Services AD CS that allows a low-privileged domain user to impersonate a Domain Controller and achieve full domain compromise. CVE:...
CVE-2026-94483 Next.js: Server-Side Request Forgery in Image Optimization
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL...
Exploit for Argument Injection in Thecodingmachine Gotenberg
CVE-2026-40281 Gotenberg --- 📖 Table of...
CVE-2026-104611
A vulnerability was detected in Tenda AC9 15.03.02.13. Affected is an unknown function of the file /goform/fastsettinginternetset of the component POST Request Handler. Performing a manipulation of the argument netWanType results in stack-based buffer overflow. The attack is possible to be carrie...
CVE-2026-102797
Server-Side Request Forgery SSRF vulnerability in ThemeREX Group ThemeREX Addons trxaddons allows Server Side Request Forgery.This issue affects ThemeREX Addons: from n/a through 2.46.0...
CVE-2026-102797 WordPress ThemeREX Addons plugin <= 2.46.0 - Server Side Request Forgery (SSRF) vulnerability
Server-Side Request Forgery SSRF vulnerability in ThemeREX Group ThemeREX Addons trxaddons allows Server Side Request Forgery.This issue affects ThemeREX Addons: from n/a through 2.46.0...